From 1a4b4beacbc390af2db32557f65f77c26119e620 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Wed, 25 Feb 2026 14:47:49 -0500
Subject: [PATCH 1/3] sanitize svg-icon

---
 resources/js/components/SvgIcon.vue | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/resources/js/components/SvgIcon.vue b/resources/js/components/SvgIcon.vue
index 79ad955452c..19617235e5d 100644
--- a/resources/js/components/SvgIcon.vue
+++ b/resources/js/components/SvgIcon.vue
@@ -5,6 +5,7 @@
 <script>
 import { defineAsyncComponent } from 'vue';
 import { data_get } from  '../bootstrap/globals.js'
+import DOMPurify from 'dompurify';
 
 export default {
 
@@ -53,13 +54,13 @@ export default {
         evaluateIcon() {
             if (this.customIcon) {
                 return defineAsyncComponent(() => {
-                    return new Promise(resolve => resolve({ template: this.customIcon }));
+                    return new Promise(resolve => resolve({ template: DOMPurify.sanitize(this.customIcon) }));
                 });
             }
 
             if (this.name.startsWith('<svg')) {
                 return defineAsyncComponent(() => {
-                    return new Promise(resolve => resolve({ template: this.name }));
+                    return new Promise(resolve => resolve({ template: DOMPurify.sanitize(this.name) }));
                 });
             }
 

From be7d3ca79b21a7f32a52e7ac9098107738e8aa1e Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Wed, 25 Feb 2026 14:48:01 -0500
Subject: [PATCH 2/3] reuse svg-icon

---
 resources/js/components/nav/Branch.vue | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/resources/js/components/nav/Branch.vue b/resources/js/components/nav/Branch.vue
index 33d95db5269..c2886bc1f8b 100644
--- a/resources/js/components/nav/Branch.vue
+++ b/resources/js/components/nav/Branch.vue
@@ -5,8 +5,10 @@
         <div class="flex items-center flex-1 p-2 rtl:mr-2 ltr:ml-2 text-xs leading-normal">
             <div class="flex items-center flex-1" :class="{ 'opacity-50': isHidden || isInHiddenSection }">
                 <template v-if="! isSection && ! isChild">
-                    <i v-if="isAlreadySvg" class="w-4 h-4 rtl:ml-2 ltr:mr-2" v-html="icon"></i>
-                    <svg-icon v-else class="w-4 h-4 rtl:ml-2 ltr:mr-2" :name="'light/'+icon" />
+                    <svg-icon
+                        class="w-4 h-4 rtl:ml-2 ltr:mr-2"
+                        :name="isAlreadySvg ? icon : 'light/'+icon"
+                    />
                 </template>
 
                 <a

From 588107479438626fde0174f408a4a413ec519610 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Wed, 25 Feb 2026 15:06:51 -0500
Subject: [PATCH 3/3] sanitize navitem svg

---
 src/CP/Navigation/NavItem.php   | 18 +++++++++++++++++-
 tests/CP/Navigation/NavTest.php |  9 +++++----
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/src/CP/Navigation/NavItem.php b/src/CP/Navigation/NavItem.php
index dfb95673911..83e55bc7225 100644
--- a/src/CP/Navigation/NavItem.php
+++ b/src/CP/Navigation/NavItem.php
@@ -3,6 +3,7 @@
 namespace Statamic\CP\Navigation;
 
 use Illuminate\Support\Collection;
+use Rhukster\DomSanitizer\DOMSanitizer;
 use Statamic\Facades\CP\Nav;
 use Statamic\Facades\URL;
 use Statamic\Statamic;
@@ -200,7 +201,22 @@ public function svg()
     {
         $value = $this->icon() ?? 'entries';
 
-        return Str::startsWith($value, '<svg') ? $value : Statamic::svg('icons/light/'.$value);
+        $svg = Str::startsWith($value, '<svg') ? $value : Statamic::svg('icons/light/'.$value);
+
+        return $this->sanitizeSvg($svg);
+    }
+
+    private function sanitizeSvg(string $svg): string
+    {
+        try {
+            $sanitizer = new DOMSanitizer(DOMSanitizer::SVG);
+
+            return $sanitizer->sanitize($svg, [
+                'remove-xml-tags' => ! Str::startsWith($svg, '<?xml'),
+            ]);
+        } catch (\Throwable $e) {
+            return '';
+        }
     }
 
     /**
diff --git a/tests/CP/Navigation/NavTest.php b/tests/CP/Navigation/NavTest.php
index 91834f1d861..713e8e0ff01 100644
--- a/tests/CP/Navigation/NavTest.php
+++ b/tests/CP/Navigation/NavTest.php
@@ -130,14 +130,15 @@ public function it_can_create_a_nav_item_with_a_custom_inline_svg_icon()
         $this->actingAs(tap(User::make()->makeSuper())->save());
 
         Nav::utilities('Test')
-            ->icon('<svg><circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red" /></svg>');
+            ->icon('<svg onerror="foo"><circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red" /></svg>');
 
         $item = $this->build()->get('Utilities')->last();
 
-        $expected = '<svg><circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red" /></svg>';
+        $expectedIcon = '<svg onerror="foo"><circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red" /></svg>';
+        $this->assertEquals($expectedIcon, $item->icon());
 
-        $this->assertEquals($expected, $item->icon());
-        $this->assertEquals($expected, $item->svg());
+        $expectedSvg = '<svg><circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red"/></svg>';
+        $this->assertEquals($expectedSvg, $item->svg());
     }
 
     #[Test]